Page Comparison

Prior to SmartServer 4.2, the SmartServer Configuration page Firewall tab was called the Features tab.

...

The table below lists the incoming and/or outgoing service ports that are open to the outside world by default. The default is set when re-imaging the system and when transitioning the Enable Enhanced Security option from disabled to enabled. You can sort the table by clicking on the column header.

When the Enable Enhanced Security option is checked (enabled), all of the ports listed in the table are opened, except for the ports that are marked with asterisks (**). These ports are only open by default if the service is enabled in the SmartServer Configuration pages. The consequence of closing these ports is described in the column labeled Consequence of  Closing. 

Other services can be managed from the command line using ufw firewall rules. See the Disabling / Re-enabling Other Ports section below for more information. You can optionally create a backup of the following files in case you want to undo any changes to the firewall rules:

/etc/ufw/user.rules
/etc/ufw/user6.rules

...

The table below lists internal services/ports. There are no firewall rules exposing these internal services/ports to external interfaces. You can sort the table by clicking on the column header.

...

...

1. Log into the SmartServer console using USB or SSH.
   
   

2. Enter the following command to view current firewall rules:


   Code Block
   sudo ufw status numbered

   
   

3. Take note of the rule number for SSH port 22.
   
   
   
   

4. Delete the rule for SSH port 22 using the following command (may require sudo password):

   Code Block
   sudo ufw delete <rule number for port 22>

   The following confirmation prompt appears:

   Code Block
   Proceed with operation (y|n)?

   
   

5. Enter y and press RETURN.

   Once the rule number for port 22 is deleted, SSH connection attempts will timeout and fail to connect.
   
   
   Example: disables the SSH port 22
   

   Info
   title Disabling SSH service
   You can also disable the SSH service; however, this service will be re-enabled after upgrading or re-imaging the SmartServer. To disable the SSH service, enter the following commands: Code Block sudo systemctl disable ssh sudo systemctl stop ssh

   
   

...

...

To change both of these ports you have to do the following:

1. Backup the /etc/nginx/sites-available/apollo.conf.  Use ssh/console (use apollo login) or SFTP (requires root login).
    

   Code Block
   title Making a copy of apollo.conf using console/ssh
   ls -l /etc/nginx/sites-available/ sudo cp /etc/nginx/sites-available/apollo.conf /etc/nginx/sites-available/apollo.conf.old ls -l /etc/nginx/sites-available/

   
   

2. Change three lines in the apollo.conf file. To use nano, log in as apollo "sudo

   Code Block
   title Console/SSH using nano
   sudo nano /etc/nginx/sites-available/apollo.conf

   1. default Default settings are as follows: 

      Code Block
      title apollo.conf default settings for HTTP (80) ports
      listen 80 default_server; listen [::]:80 default_server ipv6only=on;

      
      

      Code Block
      title apollo.conf default settings for HTTPS (443) ports
      listen 443 ssl;

      
      

   2. After HTTP port is changed from port 80 to port 1780, and after HTTPS port changed from 443 to 1443.

      Code Block
      title apollo.conf default settings for HTTP (1780) ports
      listen 1780 default_server; listen [::]:1780 default_server ipv6only=on;

      
      

      Code Block
      title apollo.conf default settings for HTTPS (1443) ports
      listen 1443 ssl;

      
      

   3. save Save the file.

   4.  Verify Verify changes.

      Code Block
      title Verify the change were made
      cat /etc/nginx/sites-available/apollo.conf : server { # listen on HTTP port(s) (this is the default server) # NOTE: Only use non-SSL ports for debugging! listen 1680 default_server; listen [::]:1680 default_server ipv6only=on; server_name ""; return 301 https://$host$request_uri; } server { # listen on IPv4 HTTPS port (using a self-signed certificate) # DOC: <http://nginx.org/en/docs/http/configuring_https_servers.html> # DOC: <http://www.akadia.com/services/ssh_test_certificate.html> listen 1443 ssl; :

      
      

3. See Determine what ports are open.

   1. Enter the following command:

      Code Block
      sudo ufw status numbered

      
      Image Modified



      Each port number can have multiple entries and can be input or outputs.



4. Open new ports for HTTP (1780) and HTTPS (1443). Remove the port 80 and 443 IN ports, but keep the port 80 and 443 Output ports.   The port 80 and 443 output entries are used by the SmartServer internal applications to access external servers and should not be changed. 

   Code Block
   title Close some port 80 and 443 entries, and add new 1780 and 1443 port entries
   sudo ufw allow 1780 sudo ufw allow 1780/tcp sudo ufw allow out 1680/tcp sudo ufw allow 1443/tcp sudo ufw allow 1443 sudo ufw allow out 1443/tcp sudo ufw delete allow 80/tcp sudo ufw delete allow 443 sudo ufw delete allow 443/tcp

   
   

5. Verify that port setting are correct. Make sure "that 80/tcp ALLOW OUT" and " and 443/tcp ALLOW OUT" are  are still allowed.

   Code Block
   title Ports open after changes
   $ sudo ufw status numbered Status: active To Action From -- ------ ---- [ 1] 22/tcp ALLOW IN Anywhere [ 2] 5353/udp ALLOW IN Anywhere [ 3] 2541/udp ALLOW IN Anywhere [ 4] 2541/udp ALLOW OUT Anywhere (out) [ 5] Anywhere on lo ALLOW IN Anywhere [ 6] Anywhere ALLOW OUT Anywhere on lo (out) [ 7] Anywhere DENY IN 127.0.0.0/8 [ 8] 53/udp ALLOW OUT Anywhere (out) [ 9] 5353/udp ALLOW OUT Anywhere (out) [10] 80/tcp ALLOW OUT Anywhere (out) [11] 443/tcp ALLOW OUT Anywhere (out) [12] Anywhere ALLOW OUT Anywhere on ip70 (out) [13] 123/udp ALLOW OUT Anywhere (out) [14] 25/tcp ALLOW OUT Anywhere (out) [15] 502/tcp ALLOW OUT Anywhere (out) [26] 1443 ALLOW IN Anywhere [17] 1628/udp ALLOW IN Anywhere [18] 1628/udp ALLOW OUT Anywhere (out) [19] 1883 on eth0 ALLOW IN Anywhere [20] 8883 on eth0 ALLOW IN Anywhere [21] 1780/tcp ALLOW IN Anywhere [22] 1780/tcp ALLOW OUT Anywhere (out) [23] 1780 ALLOW IN Anywhere [24] 1443/tcp ALLOW IN Anywhere [25] 1443/tcp ALLOW OUT Anywhere (out)

   
   

6. Reboot the SmartServer.

...